MAL-2025-54569 Malicious code in riana-moci12-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3caebd3f1eec75d69c2ef3a1b6aadef3f88205a0a9adb1b84780f6f18b68ccb6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kurnia-lapis21-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 176cb5c50e49f7a15119f2f3b76fb7b45dc7252b078148bd231ff9a381a83bff This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in andi-ruwet70-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b1232c465a89ea41a5694cd881372be5f3783f1307b1ed89b605674322f1956 The package andi-ruwet70-sukiwir was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flood...

MAL-2025-51421 Malicious code in citra-mangut34-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f9157a95552e73f00c626cd5c3621484ef7139586e098ca8fa7cdce317838af The package citra-mangut34-ruro was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that floode...

MAL-2025-50009 Malicious code in candra-otak-otak39-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13f37e17fe8d200ffdb4e8cd567d72bd6f32deaf84e0a6ac73439b7147ba9b0f The package candra-otak-otak39-miaww was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

Malicious code in fajar-martabak29-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8be056156d35ffe9c807846feb89b6b6f4a8dddd86723d91dc38f618df306c5f The package fajar-martabak29-riris was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

MAL-2025-50216 Malicious code in dewi-kue98-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f0e6295281ec6b87bc50383474c9d131bc1965b7c66a3b5e75ec42d85407620 The package dewi-kue98-riris was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded n...

CVE-2025-62244

Insecure direct object reference IDOR vulnerability in Publications in Liferay Portal 7.3.1 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92, and 7.3 GA through update 36 allows remote authenticated attackers to view the edi...

CVE-2025-62243

Insecure direct object reference IDOR vulnerability in Publications in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated attackers to view publication comments via the...

GHSA-2HFJ-JV6Q-762V Liferay Publications vulnerable to Authorization Bypass Through User-Controlled Key

Insecure direct object reference IDOR vulnerability in Publications in Liferay Portal 7.3.1 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92, and 7.3 GA through update 36 allows remote authenticated attackers to view the edi...

GHSA-894W-W643-QVXV Liferay Publications is vulnerable to Incorrect Authorization

Insecure direct object reference IDOR vulnerability in Publications in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated attackers to view publication comments via the...

Liferay Publications vulnerable to Authorization Bypass Through User-Controlled Key

Insecure direct object reference IDOR vulnerability in Publications in Liferay Portal 7.3.1 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92, and 7.3 GA through update 36 allows remote authenticated attackers to view the edi...

Liferay Publications is vulnerable to Incorrect Authorization

Insecure direct object reference IDOR vulnerability in Publications in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated attackers to view publication comments via the...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the comliferaychangetrackingwebportletPublicationsPortletvalue parameter. An attacker can access and modify publication comments by sending crafted URLs as an authenticated user. Remediation Upgrade...

EUVD-2025-34074

Liferay Publications vulnerable to Authorization Bypass Through User-Controlled Key...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the comliferaychangetrackingwebportletPublicationsPortletctCollectionId parameter. An attacker can access unauthorized publication edit pages by manipulating this parameter. Remediati...

CVE-2025-62243

Insecure direct object reference IDOR vulnerability in Publications in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated attackers to view publication comments via the...

CVE-2025-62243

Insecure direct object reference IDOR vulnerability in Publications in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated attackers to view publication comments via the...

CVE-2025-62244

Insecure direct object reference IDOR vulnerability in Publications in Liferay Portal 7.3.1 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92, and 7.3 GA through update 36 allows remote authenticated attackers to view the edi...

CVE-2025-62243

Insecure direct object reference IDOR vulnerability in Publications in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated attackers to view publication comments via the...